@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/project/topology-services.js

@@ -0,0 +1,36 @@
+import { expandServiceDeclarations } from '../infrastructure/config-normalizer.js';
+import { createDefaultRegistry } from '../infrastructure/presets/index.js';
+import { bindService } from '../infrastructure/service-binding.js';
+/** Describe explicit declarations with the provisioner's resolver; never expose credentials or infer recovery safety. */
+export function topologyServices(infrastructure, stack, dependencies) {
+    const services = [];
+    for (const [name, requirement] of Object.entries(expandServiceDeclarations(infrastructure ?? {}, createDefaultRegistry()))) {
+        const binding = bindService(requirement, stack.serviceOverrides?.[name]);
+        if (binding.provisioning === 'disabled')
+            continue;
+        services.push({
+            name,
+            runtime: binding.provisioning === 'bareMetal'
+                ? 'host'
+                : binding.provisioning === 'docker' || binding.provisioning === 'external'
+                    ? binding.provisioning
+                    : 'configured',
+            stateful: requirement.type === 'database' ||
+                requirement.type === 'storage' ||
+                Object.keys(requirement.docker?.volumes ?? {}).length > 0
+                ? true
+                : 'unknown',
+        });
+    }
+    // These legacy sections are handled separately by the actual provisioner too.
+    if (infrastructure?.tor && !services.some((service) => service.name === 'tor'))
+        services.push({ name: 'tor', runtime: 'docker', stateful: true });
+    for (const [name, container] of Object.entries(infrastructure?.containers ?? {}))
+        if (!services.some((service) => service.name === name))
+            services.push({ name, runtime: 'docker', stateful: container.volumes?.length ? true : 'unknown' });
+    for (const dependency of dependencies)
+        if (dependency.service && !services.some((service) => service.name === dependency.service))
+            services.push({ name: dependency.service, runtime: 'configured', stateful: 'unknown' });
+    return services;
+}
+//# sourceMappingURL=topology-services.js.map

package/dist/project/topology-services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topology-services.js","sourceRoot":"","sources":["../../src/project/topology-services.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAEnE,yHAAyH;AACzH,MAAM,UAAU,gBAAgB,CAC9B,cAAgD,EAChD,KAAmB,EACnB,YAAiC;IAEjC,MAAM,QAAQ,GAAkC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,yBAAyB,CAAC,cAAc,IAAI,EAAE,EAAE,qBAAqB,EAAE,CAAC,CACzE,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,YAAY,KAAK,UAAU;YAAE,SAAS;QAClD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,OAAO,EACL,OAAO,CAAC,YAAY,KAAK,WAAW;gBAClC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,KAAK,UAAU;oBACxE,CAAC,CAAC,OAAO,CAAC,YAAY;oBACtB,CAAC,CAAC,YAAY;YACpB,QAAQ,EACN,WAAW,CAAC,IAAI,KAAK,UAAU;gBAC/B,WAAW,CAAC,IAAI,KAAK,SAAS;gBAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBACvD,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IACD,8EAA8E;IAC9E,IAAI,cAAc,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC;QAC5E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,IAAI,EAAE,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACvG,KAAK,MAAM,UAAU,IAAI,YAAY;QACnC,IAAI,UAAU,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC;YACxF,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5F,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/project/topology-state.d.ts

@@ -0,0 +1,27 @@
+import type { DaemonStateStore } from '../daemon/daemon-state-store.service.js';
+import type { TopologyDraft, TopologyPlan, TopologyScope, TopologySpec } from '../shared/dto/topology.js';
+interface TopologyState {
+    version: 1;
+    generation: number;
+    desired: TopologySpec | null;
+    draft: TopologyDraft | null;
+    plans: TopologyPlan[];
+    appliedBy?: {
+        actorId: string | null;
+        actorType: string;
+    };
+}
+export declare class TopologyStateStore {
+    private readonly store;
+    constructor(store: DaemonStateStore);
+    private key;
+    read(scope: TopologyScope): TopologyState;
+    saveDraft(scope: TopologyScope, baseRevision: string, spec: TopologySpec, expectedDraft: number | null): TopologyDraft;
+    addPlan(scope: TopologyScope, plan: TopologyPlan): TopologyPlan;
+    apply(scope: TopologyScope, id: string, revision: string, actor: {
+        actorId: string | null;
+        actorType: string;
+    }): TopologyPlan;
+}
+export {};
+//# sourceMappingURL=topology-state.d.ts.map

package/dist/project/topology-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"topology-state.d.ts","sourceRoot":"","sources":["../../src/project/topology-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG1G,UAAU,aAAa;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAlC,YAA6B,KAAK,EAAE,gBAAgB,EAAI;IACxD,OAAO,CAAC,GAAG;IAMX,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAIxC;IACD,SAAS,CACP,KAAK,EAAE,aAAa,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,YAAY,EAClB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,aAAa,CAYf;IACD,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,GAAG,YAAY,CAW9D;IACD,KAAK,CACH,KAAK,EAAE,aAAa,EACpB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GACnD,YAAY,CAsBd;CACF"}

package/dist/project/topology-state.js

@@ -0,0 +1,71 @@
+import { topologyRevision, validateTopologySpec } from './topology-plan.js';
+const empty = () => ({ version: 1, generation: 0, desired: null, draft: null, plans: [] });
+export class TopologyStateStore {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    key(scope) {
+        for (const value of [scope.project, scope.stack])
+            if (typeof value !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(value))
+                throw new Error('Invalid topology scope');
+        return `topology:${scope.project}/${scope.stack}`;
+    }
+    read(scope) {
+        const state = this.store.kvGetSync(this.key(scope), { strict: true });
+        if (state && state.version !== 1)
+            throw new Error('Unsupported persisted topology version');
+        return state ?? empty();
+    }
+    saveDraft(scope, baseRevision, spec, expectedDraft) {
+        const validated = validateTopologySpec(spec);
+        return this.store.kvUpdateSync(this.key(scope), (current) => {
+            const state = current ?? empty();
+            if ((state.draft?.revision ?? null) !== expectedDraft)
+                throw new Error('Topology draft changed in another session; reload before saving');
+            return {
+                ...state,
+                generation: state.generation + 1,
+                draft: { revision: state.generation + 1, baseRevision, spec: validated, updatedAt: new Date().toISOString() },
+            };
+        }).draft;
+    }
+    addPlan(scope, plan) {
+        this.store.kvUpdateSync(this.key(scope), (current) => {
+            const state = current ?? empty();
+            if (state.draft?.revision !== plan.draftRevision ||
+                topologyRevision(state.draft.spec) !== topologyRevision(plan.spec))
+                throw new Error('Draft changed while planning; build a fresh plan');
+            return { ...state, plans: [plan, ...state.plans].slice(0, 20) };
+        });
+        return plan;
+    }
+    apply(scope, id, revision, actor) {
+        const state = this.store.kvUpdateSync(this.key(scope), (current) => {
+            if (!current)
+                throw new Error('Topology plan not found');
+            const plan = current.plans.find((candidate) => candidate.id === id);
+            if (!plan)
+                throw new Error('Topology plan not found');
+            if (plan.status === 'applied')
+                return current;
+            if (plan.baseRevision !== revision || plan.draftRevision !== current.draft?.revision)
+                throw new Error('Topology plan is stale; rebuild it from the current configuration and draft');
+            if (Date.parse(plan.expiresAt) <= Date.now())
+                throw new Error('Topology plan expired; create a fresh plan');
+            if (plan.issues.some((issue) => issue.severity === 'error'))
+                throw new Error('Topology plan contains blocking issues');
+            const applied = { ...plan, status: 'applied', appliedAt: new Date().toISOString() };
+            return {
+                ...current,
+                generation: current.generation + 1,
+                desired: plan.spec,
+                draft: null,
+                plans: current.plans.map((value) => (value.id === id ? applied : value)),
+                appliedBy: actor,
+            };
+        });
+        return state.plans.find((plan) => plan.id === id);
+    }
+}
+//# sourceMappingURL=topology-state.js.map

package/dist/project/topology-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topology-state.js","sourceRoot":"","sources":["../../src/project/topology-state.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU5E,MAAM,KAAK,GAAG,GAAkB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1G,MAAM,OAAO,kBAAkB;IACA,KAAK;IAAlC,YAA6B,KAAuB;qBAAvB,KAAK;IAAqB,CAAC;IAChD,GAAG,CAAC,KAAoB;QAC9B,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;YAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,OAAO,YAAY,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAoB;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5F,OAAO,KAAK,IAAI,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,SAAS,CACP,KAAoB,EACpB,YAAoB,EACpB,IAAkB,EAClB,aAA4B;QAE5B,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAgB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE;YACzE,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,aAAa;gBACnD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACrF,OAAO;gBACL,GAAG,KAAK;gBACR,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC;gBAChC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;aAC9G,CAAC;QACJ,CAAC,CAAC,CAAC,KAAM,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,KAAoB,EAAE,IAAkB;QAC9C,IAAI,CAAC,KAAK,CAAC,YAAY,CAAgB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE;YAClE,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC;YACjC,IACE,KAAK,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC,aAAa;gBAC5C,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAElE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CACH,KAAoB,EACpB,EAAU,EACV,QAAgB,EAChB,KAAoD;QAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAgB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE;YAChF,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACtD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YAC9C,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,KAAK,EAAE,QAAQ;gBAClF,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;YACjG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC5G,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAiB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAClG,OAAO;gBACL,GAAG,OAAO;gBACV,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;gBAClC,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACxE,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;IACrD,CAAC;CACF"}

package/dist/project/workspace-kind.d.ts

@@ -0,0 +1,3 @@
+/** Package identity, not the directory/project name, identifies the control plane. */
+export declare function isControlPlaneWorkspace(directory: string): boolean;
+//# sourceMappingURL=workspace-kind.d.ts.map

package/dist/project/workspace-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-kind.d.ts","sourceRoot":"","sources":["../../src/project/workspace-kind.ts"],"names":[],"mappings":"AAGA,sFAAsF;AACtF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOlE"}

package/dist/project/workspace-kind.js

@@ -0,0 +1,13 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/** Package identity, not the directory/project name, identifies the control plane. */
+export function isControlPlaneWorkspace(directory) {
+    try {
+        const manifest = JSON.parse(fs.readFileSync(path.join(directory, 'package.json'), 'utf8'));
+        return manifest.name === '@omnitron-dev/omnitron';
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=workspace-kind.js.map

package/dist/project/workspace-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-kind.js","sourceRoot":"","sources":["../../src/project/workspace-kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,sFAAsF;AACtF,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAsB,CAAC;QAChH,OAAO,QAAQ,CAAC,IAAI,KAAK,wBAAwB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/readiness.d.ts

@@ -0,0 +1,4 @@
+/** Standalone schema readiness; importing this entry never starts a daemon. */
+export { requirePostgresSchema, SchemaReadinessError, requiredColumn, nullableColumn } from '@omnitron-dev/titan-database/readiness';
+export type { PostgresSchemaRequirement, PostgresTableRequirement, PostgresColumnRequirement, PostgresForeignKeyRequirement, PostgresReadinessOptions } from '@omnitron-dev/titan-database/readiness';
+//# sourceMappingURL=readiness.d.ts.map

package/dist/readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../src/readiness.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACrI,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC"}

package/dist/readiness.js

@@ -0,0 +1,3 @@
+/** Standalone schema readiness; importing this entry never starts a daemon. */
+export { requirePostgresSchema, SchemaReadinessError, requiredColumn, nullableColumn } from '@omnitron-dev/titan-database/readiness';
+//# sourceMappingURL=readiness.js.map

package/dist/readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../src/readiness.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC"}

package/dist/release/application-closure.d.ts

@@ -0,0 +1,4 @@
+import type { IEcosystemAppEntry } from '../config/types.js';
+export declare const CLOSURE_FILE = ".omnitron-closure.json";
+export declare function stageApplicationClosure(source: string, directory: string, entry: IEcosystemAppEntry, checkouts: readonly string[], verifyPackage?: import('./registry-framework.js').RegistryFramework['verifyPackage']): Promise<void>;
+//# sourceMappingURL=application-closure.d.ts.map

package/dist/release/application-closure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-closure.d.ts","sourceRoot":"","sources":["../../src/release/application-closure.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,eAAO,MAAM,YAAY,2BAA2B,CAAC;AAWrD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,EACtI,aAAa,CAAC,EAAE,OAAO,yBAAyB,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CrG"}

package/dist/release/application-closure.js

@@ -0,0 +1,61 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { installedGraph, materializeGraph } from './installed-graph.js';
+import { frameworkDependencyDigest, releaseTreeDigest } from './runtime-provenance.js';
+import { targetRuntime, releaseOptionsForEnv } from './target-runtime.js';
+export const CLOSURE_FILE = '.omnitron-closure.json';
+export async function stageApplicationClosure(source, directory, entry, checkouts, verifyPackage) {
+    const nodeOptions = releaseOptionsForEnv(entry.env);
+    const packages = await installedGraph(source, new Map(), await Promise.all(checkouts.map(root => fs.realpath(root))));
+    const destinations = packages.map((_, index) => index === 0 ? directory : path.join(directory, 'node_modules/.omnitron', String(index)));
+    await materializeGraph(packages, destinations, { application: true });
+    if (entry.bootstrap) {
+        // Every bootstrap resolves its private Titan from the application package.
+        // An ancestor or NODE_PATH on the build machine is outside the portable graph.
+        const titan = packages[0].dependencies.get('@omnitron-dev/titan');
+        if (titan === undefined)
+            throw Error(`Bootstrap application ${entry.name} must declare @omnitron-dev/titan as a runtime dependency`);
+        const request = createRequire(path.join(directory, 'package.json'));
+        const resolved = await fs.realpath(request.resolve('@omnitron-dev/titan'));
+        const shipped = await fs.realpath(destinations[titan]);
+        if (!resolved.startsWith(shipped + path.sep))
+            throw Error(`Bootstrap application ${entry.name} resolved Titan outside its packaged dependency`);
+    }
+    if (verifyPackage) {
+        // An app build controls its installed tree. A renamed manifest must not
+        // erase the identity promised by the dependency edge pointing at it.
+        const checks = new Map();
+        const requireArchive = (name, index) => {
+            if (!name.startsWith('@omnitron-dev/'))
+                return;
+            const locations = checks.get(name) ?? new Set();
+            locations.add(index);
+            checks.set(name, locations);
+        };
+        for (const [index, pkg] of packages.entries()) {
+            requireArchive(pkg.metadata.name, index);
+            for (const [name, child] of pkg.dependencies)
+                requireArchive(name, child);
+        }
+        for (const [name, locations] of checks) {
+            for (const index of locations)
+                await verifyPackage(name, destinations[index]);
+        }
+    }
+    const bindings = {}, roots = {};
+    for (const [index, pkg] of packages.entries())
+        for (const [name, child] of pkg.dependencies) {
+            if (!name.startsWith('@omnitron-dev/') || name === '@omnitron-dev/omnitron')
+                continue;
+            if (roots[name] && roots[name] !== destinations[child])
+                throw Error('Ambiguous shared framework identity: ' + name);
+            roots[name] = destinations[child];
+            (bindings[name] ??= []).push(path.relative(directory, path.join(destinations[index], 'node_modules', name)).split(path.sep).join('/'));
+        }
+    const closure = { protocol: 1, runtime: await targetRuntime(), nodeOptions,
+        bindings, frameworkSha256: await frameworkDependencyDigest(directory, roots),
+        payloadSha256: await releaseTreeDigest(directory, true, false, [CLOSURE_FILE]) };
+    await fs.writeFile(path.join(directory, CLOSURE_FILE), JSON.stringify(closure, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+}
+//# sourceMappingURL=application-closure.js.map

package/dist/release/application-closure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-closure.js","sourceRoot":"","sources":["../../src/release/application-closure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAsB,MAAM,qBAAqB,CAAC;AAE9F,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAWrD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAyB,EAAE,SAA4B,EACtI,aAAoF;IACpF,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzI,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC,yBAAyB,KAAK,CAAC,IAAI,2DAA2D,CAAC,CAAC;QACrI,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAE,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,yBAAyB,KAAK,CAAC,IAAI,iDAAiD,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;YACrD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,OAAO;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACxD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY;gBAAE,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,SAAS;gBAAE,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,CAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAA6B,EAAE,EAAE,KAAK,GAA2B,EAAE,CAAC;IAClF,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE;QAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YAC5F,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,IAAI,KAAK,wBAAwB;gBAAE,SAAS;YACtF,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,IAAI,CAAC,CAAC;YACpH,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAE,CAAC;YACnC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1I,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,aAAa,EAAE,EAAE,WAAW;QAC5F,QAAQ,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC;QAC5E,aAAa,EAAE,MAAM,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/H,CAAC"}

package/dist/release/archive.d.ts

@@ -0,0 +1,3 @@
+export { releaseFileHashes, sha256File, writePortableArchive } from './portable-archive.js';
+export { inspectReleaseArtifact, type InspectReleaseArtifactOptions, type InspectReleaseFileRequest, type ReleaseArtifactInspection, type InspectedReleaseFile } from './artifact-inspection.js';
+//# sourceMappingURL=archive.d.ts.map

package/dist/release/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/release/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,KAAK,yBAAyB,EAAE,KAAK,yBAAyB,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/release/archive.js

@@ -0,0 +1,3 @@
+export { releaseFileHashes, sha256File, writePortableArchive } from './portable-archive.js';
+export { inspectReleaseArtifact } from './artifact-inspection.js';
+//# sourceMappingURL=archive.js.map

package/dist/release/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../src/release/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAiI,MAAM,0BAA0B,CAAC"}

package/dist/release/artifact-inspection.d.ts

@@ -0,0 +1,50 @@
+import type { ReleaseArtifact, ReleaseArtifactReference, ReleaseManifest } from './manifest.js';
+import { type TargetRuntime } from './target-runtime.js';
+export interface InspectedReleaseFile {
+    /** Package-relative physical regular member; never a temporary filesystem path. */
+    readonly path: string;
+    readonly sha256: string;
+    readonly bytes: number;
+    /** Exact bytes, not an import, evaluation or interpretation of declarations. */
+    readonly contents?: Buffer;
+}
+export interface ReleaseArtifactInspection {
+    readonly manifest: ReleaseManifest;
+    readonly manifestSha256: string;
+    /** Consumer name and artifact metadata as recorded in the selected manifest. */
+    readonly artifact: ReleaseArtifact;
+    readonly producer: {
+        readonly manifest: ReleaseManifest;
+        readonly manifestSha256: string;
+        readonly app: string;
+        readonly chain: readonly ReleaseArtifactReference[];
+    };
+    readonly closure: {
+        readonly sha256: string;
+        readonly payloadSha256: string;
+        /** The producer's declared target, checked against its closure, not this host. */
+        readonly target: TargetRuntime;
+        readonly nodeOptions: string;
+    };
+    /** Launch (when present) first, then requested files in request order, each member once. */
+    readonly files: readonly InspectedReleaseFile[];
+}
+export interface InspectReleaseFileRequest {
+    readonly path: string;
+    /** Explicit opt-in: at most 4 MiB/file and 16 MiB total. Default is streaming hash/size only. */
+    readonly includeContents?: boolean;
+}
+export interface InspectReleaseArtifactOptions {
+    readonly releasesRoot?: string;
+    /** At most 64 distinct regular members of any type, in addition to the launch entry. */
+    readonly files?: readonly InspectReleaseFileRequest[];
+}
+/**
+ * Diagnostic integrity evidence, not deployment admission or execution authorization.
+ * Uses the same origin, extractor and closure checks as installation. The manifest's
+ * producer target may differ from this host. No owner, package install, operational
+ * receipt or application code execution is involved. Temporary copies are removed
+ * on success and failure; only evidence and explicitly requested bounded bytes leave this scope.
+ */
+export declare function inspectReleaseArtifact(releaseId: string, app: string, options?: InspectReleaseArtifactOptions): Promise<ReleaseArtifactInspection>;
+//# sourceMappingURL=artifact-inspection.d.ts.map

package/dist/release/artifact-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-inspection.d.ts","sourceRoot":"","sources":["../../src/release/artifact-inspection.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhG,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;QACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;KACrD,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,kFAAkF;QAClF,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD;AAwED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,6BAAkC,GAC1E,OAAO,CAAC,yBAAyB,CAAC,CA8DpC"}

package/dist/release/artifact-inspection.js

@@ -0,0 +1,169 @@
+/** Read verified artifact files without installing or evaluating an application. */
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { CLOSURE_FILE } from './application-closure.js';
+import { assertFrozenDirectory, assertFrozenLaunch, extractFrozenArchive, verifyFrozenApplication, verifyFrozenPayload } from './frozen-installation.js';
+import { loadRelease } from './load.js';
+import { artifactReleaseContext, assertImportableArtifact } from './origin.js';
+import { sha256File } from './portable-archive.js';
+import { releaseNodeOptions } from './target-runtime.js';
+const MAX_FILE_BYTES = 4 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 16 * 1024 * 1024;
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+function recordedTarget(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) ||
+        !['platform', 'arch', 'node', 'abi'].every(key => {
+            const text = value[key];
+            return typeof text === 'string' && text.length > 0 && text.length <= 256;
+        }) || typeof value.executableSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(value.executableSha256) ||
+        (value.libc !== null && (typeof value.libc !== 'string' || !value.libc || value.libc.length > 256)))
+        throw Error('Artifact inspection requires a complete recorded execution target');
+    return { platform: value.platform, arch: value.arch, node: value.node, abi: value.abi,
+        executableSha256: value.executableSha256, libc: value.libc };
+}
+/** Private extracted input only. Bound actual reads as well as the initial stat. */
+async function readPhysical(file, limit) {
+    const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await handle.stat({ bigint: true });
+        if (!before.isFile() || before.size > BigInt(limit))
+            throw Error('Inspected release file exceeds its byte limit or is not physical');
+        const bytes = Buffer.alloc(Number(before.size) + 1);
+        let length = 0;
+        while (length < bytes.length) {
+            const read = await handle.read(bytes, length, bytes.length - length, null);
+            if (!read.bytesRead)
+                break;
+            length += read.bytesRead;
+        }
+        const after = await handle.stat({ bigint: true });
+        if (BigInt(length) !== before.size || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+            throw Error('Inspected release file changed while reading');
+        return bytes.subarray(0, length);
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Selection does not follow in-tree aliases, even though dependencies may use them. */
+async function physicalMember(root, relative) {
+    if (!relative || relative.length > 4096 || /[\\:\0]/.test(relative) ||
+        relative.split('/').some(part => !part || part === '.' || part === '..'))
+        throw Error('Expected a package-relative physical release file: ' + relative);
+    const file = path.join(root, relative);
+    if (file !== await fs.realpath(file) || !(await fs.lstat(file)).isFile())
+        throw Error('Requested release member must be a physical regular file: ' + relative);
+    return file;
+}
+async function inspectPhysical(file, includeContents, limit) {
+    if (includeContents) {
+        const contents = await readPhysical(file, limit);
+        return { sha256: hash(contents), bytes: contents.length, contents };
+    }
+    const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await handle.stat({ bigint: true });
+        if (!before.isFile())
+            throw Error('Requested release member is not a physical regular file');
+        const digest = createHash('sha256');
+        let bytes = 0;
+        for await (const chunk of handle.createReadStream({ autoClose: false })) {
+            bytes += chunk.length;
+            if (BigInt(bytes) > before.size)
+                throw Error('Inspected release file changed while reading');
+            digest.update(chunk);
+        }
+        const after = await handle.stat({ bigint: true });
+        if (BigInt(bytes) !== before.size || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+            throw Error('Inspected release file changed while reading');
+        return { sha256: digest.digest('hex'), bytes };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Diagnostic integrity evidence, not deployment admission or execution authorization.
+ * Uses the same origin, extractor and closure checks as installation. The manifest's
+ * producer target may differ from this host. No owner, package install, operational
+ * receipt or application code execution is involved. Temporary copies are removed
+ * on success and failure; only evidence and explicitly requested bounded bytes leave this scope.
+ */
+export async function inspectReleaseArtifact(releaseId, app, options = {}) {
+    const input = options.files ?? [];
+    if (!Array.isArray(input) || input.length > 64)
+        throw Error('Expected at most 64 distinct release file requests');
+    // Snapshot primitives before the first await; callers retain ownership of their arrays/objects.
+    const requested = input.map(file => {
+        if (!file || typeof file !== 'object')
+            throw Error('Expected a release file request');
+        const { path: relative, includeContents } = file;
+        if (typeof relative !== 'string' || (includeContents !== undefined && typeof includeContents !== 'boolean'))
+            throw Error('Expected a release path and optional boolean includeContents');
+        return { path: relative, includeContents: includeContents === true };
+    });
+    if (new Set(requested.map(file => file.path)).size !== requested.length)
+        throw Error('Expected at most 64 distinct release file requests');
+    // loadRelease validates all embedded origins and every archive SHA/size before selection.
+    const release = await loadRelease(releaseId, options.releasesRoot);
+    const artifact = release.manifest.artifacts.find(value => value.app === app);
+    const archive = release.files.find(value => value.app === app);
+    if (!artifact || !archive)
+        throw Error('No release artifact for ' + releaseId + '/' + app);
+    const producer = artifactReleaseContext(release.manifest, app);
+    const launch = producer.artifact.launch;
+    if (launch || !producer.artifact.closureSha256)
+        assertFrozenLaunch(launch);
+    const target = recordedTarget(producer.manifest.builtWith.target);
+    if (!launch)
+        assertImportableArtifact(producer.manifest, producer.artifact);
+    const closureSha256 = producer.artifact.closureSha256 ?? launch.closureSha256;
+    const temporary = await fs.mkdtemp(path.join(await fs.realpath(os.tmpdir()), 'omnitron-artifact-inspection-'));
+    try {
+        await assertFrozenDirectory(temporary);
+        const copied = path.join(temporary, 'archive.tar.gz'), payload = path.join(temporary, 'payload');
+        await fs.mkdir(payload, { mode: 0o700 });
+        await fs.copyFile(archive.path, copied, constants.COPYFILE_FICLONE | constants.COPYFILE_EXCL);
+        if ((await fs.lstat(copied)).size !== archive.bytes || await sha256File(copied) !== archive.sha256)
+            throw Error('Release archive changed before inspection');
+        await extractFrozenArchive(copied, payload);
+        const raw = await readPhysical(path.join(payload, CLOSURE_FILE), 2_000_000);
+        if (hash(raw) !== closureSha256)
+            throw Error('Frozen closure differs from the admitted manifest');
+        const closure = JSON.parse(raw.toString('utf8'));
+        if (!closure || typeof closure !== 'object' || Array.isArray(closure) ||
+            !('nodeOptions' in closure) || typeof closure.nodeOptions !== 'string')
+            throw Error('Invalid frozen closure Node options');
+        if (!('protocol' in closure) || closure.protocol !== 1)
+            throw Error('Unsupported frozen closure protocol');
+        if (!('payloadSha256' in closure) || typeof closure.payloadSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(closure.payloadSha256))
+            throw Error('Invalid frozen closure payload digest');
+        const nodeOptions = releaseNodeOptions(closure.nodeOptions);
+        const verify = () => launch ? verifyFrozenApplication(payload, launch, target, nodeOptions) : verifyFrozenPayload(payload, closureSha256, target, nodeOptions);
+        await verify();
+        const files = [];
+        let total = 0;
+        const selected = launch ? [{ path: launch.file, includeContents: requested.find(file => file.path === launch.file)?.includeContents ?? false },
+            ...requested.filter(file => file.path !== launch.file)] : requested;
+        for (const request of selected) {
+            const file = await physicalMember(payload, request.path);
+            const evidence = await inspectPhysical(file, request.includeContents === true, Math.min(MAX_FILE_BYTES, MAX_TOTAL_BYTES - total));
+            total += evidence.contents?.length ?? 0;
+            files.push({ path: request.path, ...evidence });
+        }
+        // Detect any change during requested reads, including private dependency bytes.
+        await verify();
+        return { manifest: release.manifest, manifestSha256: release.manifestSha256, artifact,
+            producer: { manifest: producer.manifest,
+                manifestSha256: producer.chain.at(-1)?.manifestSha256 ?? release.manifestSha256,
+                app: producer.artifact.app, chain: producer.chain },
+            closure: { sha256: closureSha256, payloadSha256: closure.payloadSha256, target, nodeOptions }, files };
+    }
+    finally {
+        await fs.rm(temporary, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=artifact-inspection.js.map

package/dist/release/artifact-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-inspection.js","sourceRoot":"","sources":["../../src/release/artifact-inspection.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACzJ,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AA6C7E,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEjF,SAAS,cAAc,CAAC,KAAgC;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3D,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,GAA0B,CAAC,CAAC;YAC/C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAClG,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACrI,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM;YAC3B,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YACtI,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IAC1D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/D,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QAC1E,MAAM,KAAK,CAAC,qDAAqD,GAAG,QAAQ,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;QACtE,MAAM,KAAK,CAAC,4DAA4D,GAAG,QAAQ,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,eAAwB,EAAE,KAAa;IAClF,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACxE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI;gBAAE,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC7F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YACrI,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EAAE,GAAW,EAAE,OAAO,GAAkC,EAAE;IAE3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAClH,gGAAgG;IAChG,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACtF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QACjD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,eAAe,KAAK,SAAS,CAAC;YACzG,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,KAAK,IAAI,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QACrE,MAAM,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACpE,0FAA0F;IAC1F,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;QAAE,MAAM,KAAK,CAAC,0BAA0B,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxC,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa;QAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,aAAa,IAAI,MAAO,CAAC,aAAa,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAC/G,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,gBAAgB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM;YAChG,MAAM,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,aAAa;YAAE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAClG,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACjE,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC/H,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3G,IAAI,CAAC,CAAC,eAAe,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7H,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC/J,MAAM,MAAM,EAAE,CAAC;QACf,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,eAAe,IAAI,KAAK,EAAE;YAC5I,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;YAClI,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,gFAAgF;QAChF,MAAM,MAAM,EAAE,CAAC;QACf,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,QAAQ;YACnF,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBACrC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc;gBAC/E,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;YACrD,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC;IAC3G,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACzE,CAAC"}

package/dist/release/artifact-volumes.d.ts

@@ -0,0 +1,10 @@
+import type { IEcosystemAppEntry, IEcosystemConfig } from '../config/types.js';
+import type { ArtifactVolumeBinding, InfrastructureConfig } from '../infrastructure/types.js';
+/** Synchronous structural checks run before archive preparation or deployment mutations. */
+export declare function artifactVolumeBindings(infrastructure?: InfrastructureConfig, requireServices?: boolean): Array<[string, ArtifactVolumeBinding]>;
+export declare function artifactVolumeEntries(infrastructure: InfrastructureConfig | undefined, entries: readonly IEcosystemAppEntry[], requireServices?: boolean): IEcosystemAppEntry[];
+/** Include disabled payload declarations only when a stack explicitly mounts their artifacts. */
+export declare function releaseBuildEntries(config: IEcosystemConfig): IEcosystemAppEntry[];
+/** Replace declarations only in an ephemeral provisioning copy. No config/store/selection writes. */
+export declare function bindArtifactVolumes(infrastructure: InfrastructureConfig | undefined, roots: ReadonlyMap<string, string>): Promise<InfrastructureConfig | undefined>;
+//# sourceMappingURL=artifact-volumes.d.ts.map

package/dist/release/artifact-volumes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-volumes.d.ts","sourceRoot":"","sources":["../../src/release/artifact-volumes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAgB,MAAM,4BAA4B,CAAC;AAU5G,4FAA4F;AAC5F,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,oBAAoB,EAAE,eAAe,UAAO,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CA0B5I;AAED,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,oBAAoB,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,kBAAkB,EAAE,EAAE,eAAe,UAAO,GAAG,kBAAkB,EAAE,CAO5K;AAED,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,kBAAkB,EAAE,CAQlF;AA6BD,qGAAqG;AACrG,wBAAsB,mBAAmB,CAAC,cAAc,EAAE,oBAAoB,GAAG,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAczK"}